Networking

flex.plane provides software-defined networking for VMs: virtual networks backed by Proxmox Linux bridges, automatic IP address management, and a secure WireGuard mesh overlay for inter-node communication. This replaces what you'd need Open vSwitch or VMware NSX for in more complex setups.

Understand virtual networks

A virtual network in flex.plane maps to a Linux bridge on your Proxmox nodes. Each network has:

• An ID: used to name interfaces and resources in Proxmox (e.g., 100)
• A name: a human-readable label (e.g., "production")
• An IP range: the subnet in CIDR notation (e.g., 10.0.0.0/24)
• A gateway: automatically derived from the IP range

To create a network, navigate to Networking > Networks and click Create Network. Specify an ID, name, and IP range.

Create a network by specifying an ID, name, and IP range in CIDR notation.

The Networks page lists all virtual networks with their ID, name, IP range, and gateway.

Networks are VDC-scoped when used within a Virtual Datacenter. Each VDC can have its own set of networks with isolated IP ranges, providing network-level tenant separation.

VMs can be connected to multiple networks (up to 4 network interfaces per VM). When creating a VM, you specify which networks to attach. You can also connect and disconnect networks from running VMs on the VM's Networks tab.

The VM Networks tab shows each connected interface with its network, IP address, and MAC address.

Edge gateways and firewalls

Each VDC can have an edge gateway that provides network boundary services.

The edge gateway shows connected networks with their gateway IPs and firewall configuration.

Edge gateways provide:

• Gateway routing between VDC networks and external networks
• Stateful firewall with configurable default policies and ordered rule sets
• Service exposure for making VDC services accessible externally

Secure inter-node communication

All communication between the orchestrator and agents, and between agents across nodes, travels over a peer-to-peer WireGuard-based VPN overlay network. This mesh provides:

• Encryption. All traffic between nodes is encrypted with WireGuard. No plaintext API calls traverse your network.
• Authentication. Nodes authenticate to the mesh using cryptographic keys. Joining the mesh requires a valid join token issued by the platform.
• Service discovery. The orchestrator discovers nodes and zones through the mesh control server. When a new agent connects, it automatically becomes visible to the orchestrator.
• NAT traversal. WireGuard's peer-to-peer design handles NAT traversal, allowing nodes behind firewalls or in different networks to communicate without complex VPN configurations.

The mesh control server runs alongside the orchestrator in the management Kubernetes cluster. Agents on Proxmox nodes connect to it to register themselves and discover peers.